work boxen is either a sysadmin or technically adept anyway so if they leave it 'Net enabled and there is a 3rd party who controls it then it's their own fault.

Sneakernet your work boxen and all is invisible if you are sensible.